llms.sgit.ai — brief pack
For: the agent commissioned to build llms.sgit.ai
From: Dinis Cruz, via the SG/Send Librarian
Version: v0.33.62 · 24 August 2026
Licence: CC BY 4.0 — see LICENSE.md, which carries a key-handling rule specific to this site.
What this is
Your LLM work, and specifically how to add an LLM chat pane to websites and vaults, with code samples.
The vault half is shipped, complete, and documented in a place no human reader will find. The website half is thin. The pack says which is which rather than levelling them.
The thesis
Your app calls a language model without ever holding an API key.
The key lives in .vault/llm/config.json, inside the permission floor — the app cannot read it. The host makes the call.
And the qualification, which belongs on the same page (03__ §5): the bridge protects the vault's key. It is not yet an egress boundary — the corpus says so itself: "This is the gap that turns the current design from a convenience into a guarantee."
The headline: three chat-pane surfaces, not one
| Surface | Code | Permission |
|---|---|---|
1. Vault chat panel (/vault → ✨ AI Chat) | none | none |
2. Beside a running app (/en-gb/app/ → ✨ AI) | none | none |
| 3. Inside your own app | yes | permissions.llm.chat |
Surfaces 1 and 2 run on host chrome at the real origin, so they hold the vault key and the microphone directly; the sandboxed app frame sees neither. The sentence to feature:
"Every existing vault app gets this without being changed."
It is currently buried in a debrief.
Read in this order
| File | Words | What it does |
|---|---|---|
00__BRIEF.md | 1.2k | Start here. Three surfaces, the thesis, what is shipped, the CSP gap, the wider work, the build order |
01__the-chat-pane.md | 1.4k | The commission. The decision table, all three surfaces, the honesty mechanisms, vault setup and key tiers |
code__chat-pane-samples.md | 1.4k | Runnable samples — minimum pane, cancel, cost meter, model picker, images, voice, file grounding, and a pre-ship checklist |
02__the-sg-llm-api.md | 1.3k | The full sg.llm.* reference, the streaming contract, 9 error codes, and the traps |
03__the-security-model.md | 1.1k | The four-layer ladder, key tiers, the unfakeable recording indicator, and the gap |
04__websites-vs-vaults.md | 1.0k | What changes with no host. Three options, honestly compared — the thin half |
05__the-wider-llm-work.md | 1.2k | Provenance since 2024, OpenRouter, local models, injection, and what is not built |
06__site-architecture.md | 0.8k | Page by page, what must be generated, and the demo vault that is the documentation |
07__boundaries-and-licensing.md | 0.8k | The second-source-of-truth problem, key rules, network boundaries |
08__gaps-and-open-questions.md | 1.1k | 8 build-fresh items, 8 open questions, 7 tensions |
09__source-manifest.csv | 24 rows | Every source, tiered 0–3. Every path verified on disk |
Four things to know before you write
1. The best documentation is the hardest to find. The complete sg.llm.* contract exists only inside library/guides/vault-html/AUTHORING.md — a 9,487-word agent authoring document. It is genuinely excellent (the 8190 base64 explanation, the greenlet reasoning, the labelled-cost rule) and no human reader will ever open it. Extracting it is the single highest-value publishing act on this site — but generate it, don't hand-copy: the corpus explicitly refused to create a competing reference "that drifts."
2. The honesty mechanisms are the best work and are published nowhere. One 24,000-char budget shared across all attached files, not one each. TRUNCATED written into the text the model sees, "so it cannot pretend to have read the whole thing." Estimated costs rendered with ~ and never as a bill. Pasted images cleared after one send, because "an image left attached would silently re-send and re-bill on every turn." Recording stated in words — "● Recording — your microphone is on" — "not left to an icon." Publish them as decisions with reasons. That page is more persuasive than any feature tour.
3. The website half is a gap, not an asset. No component, no documented pattern, no code. 04__ compares three options — backend proxy, BYOK-in-browser (there's a precedent in the Article 9 Lab), or embed the vault surface — and recommends shipping a sg-llm-chat web component with a pluggable transport, built to the estate's own component conventions.
4. One question has no answer and it matters. The chat panel attaches vault file contents to the model's context. Those files are untrusted. What stops one that says "ignore previous instructions" from doing so? The budget and the TRUNCATED marker are honesty mechanisms, not injection defences. 08__ Q3 — do not publish an injection page until this is answered.
The artefact this site should ship
A vault app that is the documentation (06__ §4). One app exercising available, chat, streaming, cancel, usage, models, imagePart and listen — published as both the demo and the test, so the samples are verified by existing rather than by review.
⚠️ With one condition: a vault with an LLM key configured carries a credential. Either give the demo a shared-tier key with hard spend caps chosen deliberately for publication, or ask the visitor for their own key. Decide before publishing, not after.
House pattern
Copy pki.sgit.ai, add the /llms-full.txt it lacks — and note the obligation this site carries that no sibling does: a site called llms.sgit.ai will be read by more agents than any page in the estate. Your own agent-access report's finding, "it can read the map and cannot walk it", is an acceptance criterion here, not a topic.
This file is released under the Creative Commons Attribution 4.0 International licence (CC BY 4.0).